File tree 3 files changed +36
-1
lines changed
3 files changed +36
-1
lines changed Original file line number Diff line number Diff line change @@ -1035,12 +1035,21 @@ impl Url {
1035
1035
/// # run().unwrap();
1036
1036
/// ```
1037
1037
pub fn path ( & self ) -> & str {
1038
- match ( self . query_start , self . fragment_start ) {
1038
+ let path = match ( self . query_start , self . fragment_start ) {
1039
1039
( None , None ) => self . slice ( self . path_start ..) ,
1040
1040
( Some ( next_component_start) , _) |
1041
1041
( None , Some ( next_component_start) ) => {
1042
1042
self . slice ( self . path_start ..next_component_start)
1043
1043
}
1044
+ } ;
1045
+ // Disambiguating a path that starts with "//" from a URL with an authority may require
1046
+ // the serializer to insert a disambiguating marker to the start of the path.
1047
+ // When deserializing, "/./" is supposed to be reduced to "/", so avoid exposing it to
1048
+ // the application.
1049
+ if path. len ( ) >= 3 && & path[ ..3 ] == "/./" {
1050
+ & path[ 2 ..]
1051
+ } else {
1052
+ path
1044
1053
}
1045
1054
}
1046
1055
Original file line number Diff line number Diff line change @@ -1057,6 +1057,17 @@ impl<'a> Parser<'a> {
1057
1057
}
1058
1058
}
1059
1059
if ends_with_slash {
1060
+ // This is a willfull violation of the URL specification for serialization.
1061
+ //
1062
+ // It aligns with the behaviour of Microsoft Edge,
1063
+ // it does not affect the result of parsing (that's still compliant),
1064
+ // and it's necessary to make URL reparsing idempotent.
1065
+ //
1066
+ // See the specification bug at https://github.com/whatwg/url/issues/415
1067
+ if !* has_host && & self . serialization [ path_start..] == "/" {
1068
+ self . serialization . push ( '.' ) ;
1069
+ self . serialization . push ( '/' ) ;
1070
+ }
1060
1071
self . serialization . push ( '/' )
1061
1072
}
1062
1073
}
Original file line number Diff line number Diff line change 6144
6144
"pathname" : " /test" ,
6145
6145
"search" : " ?a" ,
6146
6146
"hash" : " #bc"
6147
+ },
6148
+ " Found by fuzzing" ,
6149
+ {
6150
+ "input" : " a:/a/..//a" ,
6151
+ "base" : " about:blank" ,
6152
+ "href" : " a:/.//a" ,
6153
+ "protocol" : " a:" ,
6154
+ "username" : " " ,
6155
+ "password" : " " ,
6156
+ "host" : " " ,
6157
+ "hostname" : " " ,
6158
+ "port" : " " ,
6159
+ "pathname" : " //a" ,
6160
+ "search" : " " ,
6161
+ "hash" : " "
6147
6162
}
6148
6163
]
You can’t perform that action at this time.
0 commit comments